Skip to content
This repository was archived by the owner on Sep 2, 2025. It is now read-only.

Commit bd992d1

Browse files
Merge pull request #2408 from splunk/urbiz-OD5517-gcp-auth
[5517]: GCP auth with WIF
2 parents c2ff790 + 490f802 commit bd992d1

File tree

3 files changed

+175
-141
lines changed

3 files changed

+175
-141
lines changed

gdi/get-data-in/connect/gcp/gcp-connect.rst

Lines changed: 52 additions & 132 deletions
Original file line numberDiff line numberDiff line change
@@ -7,193 +7,111 @@ Connect to Google Cloud Platform: Guided setup and other options
77
.. meta::
88
:description: Connect your Google Cloud Platform / GCP account to Splunk Observability Cloud.
99

10+
You can connect your GCP account and send data to Splunk Observability Cloud with the following methods:
11+
12+
* :ref:`gcp-connect-ui`
13+
* :ref:`gcp-api`
14+
* :ref:`gcp-terraform`
15+
16+
.. note:: Before you connect, make sure to read :ref:`gcp-prereqs`.
17+
18+
.. _gcp-connect-ui:
19+
1020
Connect to GCP using the guided setup
1121
============================================
1222

1323
Follow these steps to connect to GCP:
1424

15-
#. :ref:`gcp-one`
16-
#. :ref:`gcp-two`
17-
#. :ref:`gcp-three`
25+
* :ref:`gcp-one`
26+
* :ref:`gcp-two`
27+
* :ref:`gcp-three`
1828

1929
.. _gcp-one:
2030

21-
1. Select a role for your GCP service account
31+
1. Define a role for your GCP service account
2232
--------------------------------------------------------------------------------------
2333

24-
You can use GCP's :strong:`Viewer` role as it comes with the permissions you need for most scenarios.
25-
26-
Alternatively you can create a more restrictive role using the permissions in the table:
27-
28-
.. list-table::
29-
:header-rows: 1
30-
:widths: 35 45 20
31-
32-
* - :strong:`Permission`
33-
- :strong:`Required?`
34-
- :strong:`Included in GCP's Viewer role?`
35-
36-
* - ``compute.instances.list``
37-
- Yes, if the Compute Engine service is activated
38-
- Yes
39-
40-
* - ``compute.machineTypes.list``
41-
- Yes, if the Compute Engine service is activated
42-
- Yes
43-
44-
* - ``container.clusters.list``
45-
- Yes, if the Kubernetes (GKE) service is activated
46-
- Yes
47-
48-
* - ``container.nodes.list``
49-
- Yes, if the Kubernetes (GKE) service is activated
50-
- Yes
51-
52-
* - ``container.pods.list``
53-
- Yes, if the Kubernetes (GKE) service is activated
54-
- Yes
55-
56-
* - ``monitoring.metricDescriptors.get``
57-
- Yes
58-
- Yes
59-
60-
* - ``monitoring.metricDescriptors.list``
61-
- Yes
62-
- Yes
63-
64-
* - ``monitoring.timeSeries.list``
65-
- Yes
66-
- Yes
67-
68-
* - ``resourcemanager.projects.get``
69-
- Yes, if you want to sync project metadata (such as labels)
70-
- Yes
71-
72-
* - ``serviceusage.services.use``
73-
- Yes, if you either want to activate the use of a quota from the project where metrics are stored or sync cloud sql metadata
74-
- No, but included in ``roles/serviceusage.serviceUsageConsumer``
75-
76-
* - ``spanner.instances.list``
77-
- Yes, if the Spanner service is activated
78-
- Yes
79-
80-
* - ``storage.buckets.list``
81-
- Yes, if the Spanner service is activated
82-
- Yes
83-
84-
* - ``cloudsql.databases.list``
85-
- Yes, if the cloud sql service is activated
86-
- Yes
87-
88-
* - ``cloudsql.instances.list``
89-
- Yes, if the cloud sql service is activated
90-
- Yes
91-
92-
* - ``pubsub.topics.list``
93-
- Yes, if the pub/sub service is activated
94-
- Yes
95-
96-
* - ``pubsub.subscriptions.list``
97-
- Yes, if the pub/sub service is activated
98-
- Yes
99-
100-
* - ``run.jobs.list``
101-
- Yes, if the cloud run service is activated
102-
- Yes
103-
104-
* - ``run.revisions.list``
105-
- Yes, if the cloud run service is activated
106-
- Yes
107-
108-
* - ``cloudasset.assets.searchAllResources``
109-
- Yes, if the cloud run service is activated
110-
- Yes
111-
112-
* - ``cloudfunctions.functions.list``
113-
- Yes, if the cloud functions service is activated
114-
- Yes
34+
Use GCP's :strong:`Viewer` role as it comes with the permissions you need for most scenarios.
11535

36+
To customize the permissions for your role refer to :ref:`gcp-prereqs-role-permissions`.
11637

11738
.. _gcp-two:
11839

11940
2. Configure GCP
12041
--------------------------------------------------------------------------------------
12142

122-
To configure your GCP service, follow these steps:
43+
To configure your GCP service:
12344

124-
#. In a new window or tab, go to the Google Cloud Platform website, and log into your GCP account.
125-
#. Open the GCP web console, and select a project you want to monitor.
126-
#. From the sidebar, select :menuselection:`IAM & admin`, then :menuselection:`Service Accounts`.
127-
#. Go to :guilabel:`Create Service Account` at the top of the screen, and complete the following fields:
45+
#. Log into your GCP account and select the project you want to monitor in the GCP web console.
12846

129-
.. list-table::
130-
:header-rows: 1
131-
:widths: 40 60
47+
#. From the sidebar, select :menuselection:`IAM & admin`, then :menuselection:`Service Accounts`.
13248

133-
* - :strong:`Field`
134-
- :strong:`Description`
49+
#. Go to :guilabel:`Create Service Account` at the top of the screen, complete the following fields, and select :guilabel:`CREATE`.
13550

136-
* - Service account name
137-
- Enter ``Splunk``.
51+
* **Service account name**. Enter ``Splunk``.
13852

139-
* - Service account ID
140-
- This field autofills after you enter ``Splunk`` for Service account name.
53+
* **Service account ID**. This field autofills after you enter ``Splunk`` for Service account name.
14154

142-
* - Service account description
143-
- Enter the description for your service account.
55+
* **Service account description**. Enter the description for your service account.
14456

145-
#. Select :guilabel:`CREATE`.
14657
#. (Optional) Select a role to grant this Service account access to the selected project, then select :guilabel:`CONTINUE`.
147-
#. Activate Key type :guilabel:`JSON`, and select :guilabel:`CREATE`. A new service account key JSON file is then downloaded to your computer.
148-
#. In a new window or tab, go to :new-page:`Cloud Resource Manager API <https://console.cloud.google.com/apis/library/cloudresourcemanager.googleapis.com?pli=1>`, and activate the Cloud Resource Manager API. You need to activate this API so Splunk Infrastructure Monitoring can use it to validate permissions on the service account keys.
58+
59+
#. Activate Key type :guilabel:`JSON`, and select :guilabel:`CREATE`. A new service account key JSON file is then downloaded to your computer. You will need this key to authenticate in Splunk Observability Cloud.
60+
61+
#. In a new window or tab, go to :new-page:`Cloud Resource Manager API <https://console.cloud.google.com/apis/library/cloudresourcemanager.googleapis.com?pli=1>`, and activate the Cloud Resource Manager API. You need to activate this API so Splunk Observability Cloud can use it to validate permissions on the service account keys.
14962

15063
.. _gcp-projects:
15164

15265
.. note:: To monitor multiple GCP projects, repeat the steps described in this section for each one of the projects.
15366

15467
.. _gcp-three:
15568

156-
3. Start the integration
69+
3. Connect to Splunk Observability Cloud and start the integration
15770
--------------------------------------------------------------------------------------
15871

159-
By default, all supported services are monitored, and any new services added later are also monitored. When you set integration parameters, you can choose to import metrics from a subset of the available services.
72+
By default, Splunk Observability Cloud monitors all supported services, and any new services added later are also monitored. When you set integration parameters, you can choose to import metrics from a subset of the available services.
16073

161-
#. Log in to Splunk Observability Cloud.
162-
#. Open the :new-page:`Google Cloud Platform guided setup <https://login.signalfx.com/#/integrations/gcp>`. Optionally, you can navigate to the guided setup on your own:
74+
#. Log in to Splunk Observability Cloud and open the :new-page:`Google Cloud Platform guided setup <https://login.signalfx.com/#/integrations/gcp>`. Optionally, you can navigate to the guided setup on your own:
16375

164-
#. In the navigation menu, select :menuselection:`Data Management`.
76+
#. In the left navigation menu, select :menuselection:`Data Management`.
16577

16678
#. Go to the :guilabel:`Available integrations` tab, or select :guilabel:`Add Integration` in the :guilabel:`Deployed integrations` tab.
16779

16880
#. In the integration filter menu, select :guilabel:`By Use Case`, and select the :guilabel:`Monitor Infrastructure` use case.
16981

17082
#. In the :guilabel:`Cloud Integrations` section, select the :guilabel:`Google Cloud Platform` tile to open the Google Cloud Platform guided setup.
17183

172-
#. Go to :guilabel:`New Integration`.
84+
#. In the GCP guided setup enter a name for your new GCP integration, then :guilabel:`Add Project`.
17385

174-
#. Enter a name for the new GCP integration, then :guilabel:`Add Project`.
17586
#. Next, select :guilabel:`Import Service Account Key`, and select one or more of the JSON key files that you downloaded from GCP in :ref:`Configure GCP <gcp-two>`.
87+
17688
#. Select :guilabel:`Open`. You can then see the project IDs corresponding to the service account keys you selected.
89+
17790
#. To import :ref:`metrics <gcp-metrics>` from only some of the available services, follow these steps:
17891

17992
- Go to :guilabel:`All Services` to display a list of the services you can monitor.
18093
- Select the services you want to monitor, and then :guilabel:`Apply`.
18194

182-
#. Select the rate (in seconds) at which you want Splunk Observability Cloud to poll GCP for metric data, with 1 minute as the minimum unit, and 10 minutes as the maximum unit. For example, a value of 300 polls metrics once every 5 minutes.
183-
#. Optional:
95+
#. Select the rate (in seconds) at which you want Splunk Observability Cloud to poll GCP for metric data, with 1 minute as the minimum unit, and 10 minutes as the maximum unit. For example, a value of 300 polls metrics once every 5 minutes.
18496

185-
- List any additional GCP service domain names that you want to monitor, using commas to separate domain names in the :strong:`Custom Metric Type Domains` field.
186-
187-
- For example, to obtain Apigee metrics, add ``apigee.googleapis.com``.
188-
- To learn about custom metric type domain syntax, see :new-page:`Custom metric type domain examples <https://dev.splunk.com/observability/docs/integrations/gcp_integration_overview#Custom-metric-type-domain-examples>` in the Splunk developer documentation.
97+
Your GCP integration is now complete.
18998

190-
- If you select Compute Engine as one of the services to monitor, you can enter a comma-separated list of Compute Engine Instance metadata keys to send as properties. These metadata keys are sent as properties named ``gcp_metadata_<metadata-key>``.
99+
.. note:: Splunk is not responsible for data availability, and it can take up to several minutes (or longer, depending on your configuration) from the time you connect until you start seeing valid data from your account.
191100

192-
- Select :strong:`Use quota from the project where metrics are stored` to use a quota from the project where metrics are stored. The service account provided for the project needs either the ``serviceusage.services.use`` permission, or the `Service Usage Consumer` role.
101+
Options
102+
++++++++
193103

194-
Your GCP integration is now complete.
104+
Optionally you can:
195105

196-
.. note:: Splunk is not responsible for data availability, and it can take up to several minutes (or longer, depending on your configuration) from the time you connect until you start seeing valid data from your account.
106+
* To list any additional GCP service domain names that you want to monitor, use commas to separate domain names in the :strong:`Custom Metric Type Domains` field. For example, to obtain Apigee metrics, add ``apigee.googleapis.com``.
107+
108+
- For information on the available GCP metric domains refer to the official GCP docs at :new-page:`Google Cloud metrics <https://cloud.google.com/monitoring/api/metrics_gcp>`.
109+
110+
- To learn about custom metric type domain syntax, see :new-page:`Custom metric type domain examples <https://dev.splunk.com/observability/docs/integrations/gcp_integration_overview#Custom-metric-type-domain-examples>` in the Splunk developer documentation.
111+
112+
* If you select Compute Engine as one of the services to monitor, you can enter a comma-separated list of Compute Engine Instance metadata keys to send as properties. These metadata keys are sent as properties named ``gcp_metadata_<metadata-key>``.
113+
114+
* Select :strong:`Use quota from the project where metrics are stored` to use a quota from the project where metrics are stored. The service account provided for the project needs either the ``serviceusage.services.use`` permission, or the `Service Usage Consumer` role.
197115

198116
Alternatives to connect to GCP
199117
============================================
@@ -203,7 +121,9 @@ Alternatives to connect to GCP
203121
Integrate GCP using the API
204122
--------------------------------------------------------------------------------------
205123

206-
You can also integrate GCP with Splunk Observability Cloud using the GCP API. See :new-page:`Integrate Google Cloud Platform Monitoring with Splunk Observability Cloud <https://dev.splunk.com/observability/docs/integrations/gcp_integration_overview#Specifying-custom-metric-type-domains>` in our developer portal for details.
124+
You can also integrate GCP with Splunk Observability Cloud using the GCP API.
125+
126+
See :new-page:`Integrate Google Cloud Platform Monitoring with Splunk Observability Cloud <https://dev.splunk.com/observability/docs/integrations/gcp_integration_overview#Specifying-custom-metric-type-domains>` in our developer portal for details.
207127

208128
.. _gcp-terraform:
209129

Lines changed: 122 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,136 @@
1-
.. _gcp-prerequisites:
21
.. _gcp-prereqs:
32

43
********************************************************
5-
GCP authentication, permissions, and supported regions
4+
GCP authentication, permissions and supported regions
65
********************************************************
76

87
.. meta::
98
:description: Connect your Google Cloud Platform / GCP account to Splunk Observability Cloud.
109

11-
The following pre-requisites apply:
10+
.. _gcp-prerequisites:
1211

13-
* You must be an administrator of your Splunk Observability Cloud organization to create a GCP connection.
14-
* Splunk Observability Cloud supports all GCP regions.
12+
Prerequisites
13+
============================================
1514

16-
Account permissions
15+
You must be an administrator of your Splunk Observability Cloud organization to create a GCP connection.
16+
17+
Authenticate your Google account
1718
============================================
1819

19-
Starting in March 2024, GCP disables service account key creation by setting ``iam.disableServiceAccountKeyCreation`` to ``false`` by default. When this constraint is set, you cannot create user-managed credentials for service accounts in projects affected by the constraint. Check the restrictions on your organization's account keys before connecting to Splunk Observability Cloud.
20+
You need your service account keys to be able to integrate your GCP services with Splunk Observability Cloud. Check the restrictions on your organization's account keys before connecting to Splunk Observability Cloud.
21+
22+
For more information, refer to:
23+
24+
* GCP's docs on :new-page:`Service account keys <https://cloud.google.com/iam/docs/service-account-creds#key-types>`
25+
* Google's official announcement on the new permission policies at :new-page:`Introducing stronger default Org Policies for our customers <https://cloud.google.com/blog/products/identity-security/introducing-stronger-default-org-policies-for-our-customers/>`
26+
27+
Authenticate using Workload Identity Federation
28+
--------------------------------------------------------------------------------------
29+
30+
Alternatively, if you're connecting to Splunk Observability Cloud using the API you can use :new-page:`GCP's Workload Identity Federation (WIF) <https://cloud.google.com/iam/docs/workload-identity-federation>` to access your Google Cloud resources and authenticate them. It's safer, and with WIF you won't have to export and rotate service account keys.
31+
32+
See how to authenticate with WIF in the Splunk Observability Cloud developer documentation at :new-page:`Integrate GCP <https://dev.splunk.com/observability/docs/integrations/gcp_integration_overview>`.
33+
34+
.. _gcp-prereqs-role-permissions:
35+
36+
GCP role permissions
37+
============================================
38+
39+
You can use GCP's :strong:`Viewer` role as it comes with the permissions you need for most scenarios.
40+
41+
Alternatively you can create a more restrictive role using the permissions in the table:
42+
43+
.. list-table::
44+
:header-rows: 1
45+
:widths: 35 45 20
46+
47+
* - :strong:`Permission`
48+
- :strong:`Required?`
49+
- :strong:`Included in GCP's Viewer role?`
50+
51+
* - ``compute.instances.list``
52+
- Yes, if the Compute Engine service is activated
53+
- Yes
54+
55+
* - ``compute.machineTypes.list``
56+
- Yes, if the Compute Engine service is activated
57+
- Yes
58+
59+
* - ``container.clusters.list``
60+
- Yes, if the Kubernetes (GKE) service is activated
61+
- Yes
2062

21-
For more information, refer to Google's official announcement :new-page:`Introducing stronger default Org Policies for our customers <https://cloud.google.com/blog/products/identity-security/introducing-stronger-default-org-policies-for-our-customers/>`.
63+
* - ``container.nodes.list``
64+
- Yes, if the Kubernetes (GKE) service is activated
65+
- Yes
66+
67+
* - ``container.pods.list``
68+
- Yes, if the Kubernetes (GKE) service is activated
69+
- Yes
70+
71+
* - ``monitoring.metricDescriptors.get``
72+
- Yes
73+
- Yes
74+
75+
* - ``monitoring.metricDescriptors.list``
76+
- Yes
77+
- Yes
78+
79+
* - ``monitoring.timeSeries.list``
80+
- Yes
81+
- Yes
82+
83+
* - ``resourcemanager.projects.get``
84+
- Yes, if you want to sync project metadata (such as labels)
85+
- Yes
86+
87+
* - ``serviceusage.services.use``
88+
- Yes, if you either want to activate the use of a quota from the project where metrics are stored or sync cloud sql metadata
89+
- No, but included in ``roles/serviceusage.serviceUsageConsumer``
90+
91+
* - ``spanner.instances.list``
92+
- Yes, if the Spanner service is activated
93+
- Yes
94+
95+
* - ``storage.buckets.list``
96+
- Yes, if the Spanner service is activated
97+
- Yes
98+
99+
* - ``cloudsql.databases.list``
100+
- Yes, if the cloud sql service is activated
101+
- Yes
102+
103+
* - ``cloudsql.instances.list``
104+
- Yes, if the cloud sql service is activated
105+
- Yes
106+
107+
* - ``pubsub.topics.list``
108+
- Yes, if the pub/sub service is activated
109+
- Yes
110+
111+
* - ``pubsub.subscriptions.list``
112+
- Yes, if the pub/sub service is activated
113+
- Yes
114+
115+
* - ``run.jobs.list``
116+
- Yes, if the cloud run service is activated
117+
- Yes
118+
119+
* - ``run.revisions.list``
120+
- Yes, if the cloud run service is activated
121+
- Yes
122+
123+
* - ``cloudasset.assets.searchAllResources``
124+
- Yes, if the cloud run service is activated
125+
- Yes
126+
127+
* - ``cloudfunctions.functions.list``
128+
- Yes, if the cloud functions service is activated
129+
- Yes
130+
131+
.. _gcp-prereqs-regions:
132+
133+
Supported regions
134+
============================================
22135

136+
Splunk Observability Cloud supports all GCP regions.

0 commit comments

Comments
 (0)